ci: verify Cloudflare memory preflight

.github/workflows/ci.yml

@@ -58,3 +58,15 @@ jobs:
           secret-files: |
             confidence_client_secret=/tmp/confidence_client_secret.txt
             confidence_client_encryption_key=/tmp/confidence_client_encryption_key.txt
+
+      - name: Test Cloudflare deployer memory preflight
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        with:
+          context: .
+          target: confidence-cloudflare-resolver.memory-preflight-test
+          platforms: linux/arm64
+          push: false
+          cache-from: |
+            type=registry,ref=ghcr.io/${{ github.repository }}/cache:main
+            type=registry,ref=ghcr.io/${{ github.repository }}/cache:memory-preflight
+          cache-to: ${{ github.event_name == 'push' && format('type=registry,ref=ghcr.io/{0}/cache:memory-preflight,mode=max', github.repository) || '' }}

Dockerfile

@@ -356,6 +356,14 @@ RUN chmod +x confidence-cloudflare-resolver/deployer/script.sh
 # Default command runs the deployer script
 CMD ["./confidence-cloudflare-resolver/deployer/script.sh"]
 
+# Exercise the deployer's pinned workerd against a built Worker in CI.
+FROM confidence-cloudflare-resolver.deployer AS confidence-cloudflare-resolver.memory-preflight-test
+COPY data/resolver_state_current.pb /workspace/data/resolver_state_current.pb
+WORKDIR /workspace/confidence-cloudflare-resolver
+RUN node deployer/memory-preflight-fixture.mjs \
+    && RUSTFLAGS='--cfg getrandom_backend="wasm_js"' worker-build --release \
+    && MEMORY_PREFLIGHT_TEST_WORKER_DIR="$PWD" npm test --prefix deployer
+
 # ==============================================================================
 # OpenFeature Provider (TypeScript) - Build and test
 # ==============================================================================

confidence-cloudflare-resolver/deployer/README.md

@@ -226,7 +226,7 @@ For local validation (Node.js 22 or later), run `npm ci` in `deployer/`, build t
 node deployer/memory-preflight.mjs .
 ```
 
-Policy tests: `npm test --prefix deployer`. The probe does not upload or deploy the built artifact. Its temporary runtime directory is removed on completion. To also exercise initialization against a built Worker with a valid CDN envelope, set `MEMORY_PREFLIGHT_TEST_WORKER_DIR` to the component's absolute path when running the tests. The checked-in raw resolver-state fixture needs wrapping in a `ClientResolverState` envelope before it can be used for that integration test.
+Policy tests: `npm test --prefix deployer`. The probe does not upload or deploy the built artifact. Its temporary runtime directory is removed on completion. A separate CI step builds the `confidence-cloudflare-resolver.memory-preflight-test` Docker target, which runs the built-Worker integration test in the deployer image using a test-only CDN envelope generated by `deployer/memory-preflight-fixture.mjs`. To run that test locally, generate the fixture in a disposable checkout, build with `worker-build --release`, and set `MEMORY_PREFLIGHT_TEST_WORKER_DIR` to the component's absolute path when running the tests.
 
 The Alpine deployer image includes a separate glibc loader and libraries solely for workerd; Node and Rust continue using musl. Dependencies are pinned in the npm lockfile. Builds using an authenticated npm mirror can pass their configuration with `docker build --secret id=npmrc,src="$HOME/.npmrc" ...`; the configuration is mounted only during dependency installation and is not stored in an image layer.
 

confidence-cloudflare-resolver/deployer/memory-preflight-fixture.mjs

@@ -0,0 +1,15 @@
+import { readFile, writeFile } from 'node:fs/promises';
+
+// Wrap the checked-in raw ResolverState in the CDN ClientResolverState envelope.
+const state = await readFile('../data/resolver_state_current.pb');
+const length = [];
+let remaining = state.length;
+while (remaining >= 128) {
+  length.push((remaining & 127) | 128);
+  remaining >>>= 7;
+}
+length.push(remaining);
+await writeFile('../data/resolver_state_current.pb', Buffer.concat([
+  Buffer.from([0x0a, ...length]), state,
+  Buffer.from([0x12, 0x0c]), Buffer.from('test-account'),
+]));